Fix 2 OOB bugs in LeAudioBroadcasterImpl::UpdateMetadata

Bug: 275551881
Test: manual
Ignore-AOSP-First: security
Tag: #security
Merged-In: I6172d11a9c745018ca40e2df8b0e70f4f9728fde
Change-Id: I6172d11a9c745018ca40e2df8b0e70f4f9728fde

system/bta/le_audio/broadcaster/broadcaster.cc

@@ -277,6 +277,10 @@ class LeAudioBroadcasterImpl : public LeAudioBroadcaster, public BigCallbacks {
           ltv.Find(le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);
       if (stream_context_vec) {
         auto pp = stream_context_vec.value().data();
+        if (stream_context_vec.value().size() < 2) {
+          LOG_ERROR("stream_context_vec.value() size < 2");
+          return;
+        }
         UINT16_TO_STREAM(pp, context_type.value());
       }
     }
@@ -285,6 +289,10 @@ class LeAudioBroadcasterImpl : public LeAudioBroadcaster, public BigCallbacks {
         ltv.Find(le_audio::types::kLeAudioMetadataTypeStreamingAudioContext);
     if (stream_context_vec) {
       auto pp = stream_context_vec.value().data();
+      if (stream_context_vec.value().size() < 2) {
+        LOG_ERROR("stream_context_vec.value() size < 2");
+        return;
+      }
       STREAM_TO_UINT16(context_type.value_ref(), pp);
     }